From 2e3be74cf75eb72813e371565e6c64993dc66c06 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Dubois?= <remi.dubois@gmail.com>
Date: Tue, 24 Mar 2026 15:34:13 +0100
Subject: [PATCH] fix: conflictError when multiple Zope instances start
 simultaneously and commit OIDC settings

DEVOPS-339
---
 CHANGES.md                     |  3 ++-
 src/pas/plugins/kimug/utils.py | 12 ++++++++++--
 tests/utils/test_utils.py      | 19 +++++++++++++++++++
 3 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index 3f0a337..3457606 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,7 +1,8 @@
 ## 1.4.3 (unreleased)
 
 
-- Nothing changed yet.
+- DEVOPS-339 : Fix ConflictError when multiple Zope instances start simultaneously and commit OIDC settings
+  [remdub]
 
 
 ## 1.4.2 (2025-12-10)
diff --git a/src/pas/plugins/kimug/utils.py b/src/pas/plugins/kimug/utils.py
index 5005486..a3e4e7d 100644
--- a/src/pas/plugins/kimug/utils.py
+++ b/src/pas/plugins/kimug/utils.py
@@ -3,6 +3,7 @@
 from plone import api
 from Products.PluggableAuthService.interfaces.plugins import IAuthenticationPlugin
 from urllib.parse import urlparse
+from ZODB.POSException import ConflictError
 from zope.annotation.interfaces import IAnnotations
 from zope.component.hooks import setSite
 
@@ -74,8 +75,15 @@ def set_oidc_settings(context):
 
         _set_allowed_groups(oidc)
 
-        transaction.commit()
-        logger.info("OIDC settings set with set_oidc_settings()")
+        try:
+            transaction.commit()
+            logger.info("OIDC settings set with set_oidc_settings()")
+        except ConflictError:
+            transaction.abort()
+            logger.warning(
+                "ConflictError committing OIDC settings: another instance already "
+                "committed the same values. Settings are correct; skipping."
+            )
     else:
         logger.warning("Could not find OIDC plugin, not setting OIDC settings")
 
diff --git a/tests/utils/test_utils.py b/tests/utils/test_utils.py
index b2a21e1..b0ffccc 100644
--- a/tests/utils/test_utils.py
+++ b/tests/utils/test_utils.py
@@ -1,5 +1,7 @@
 from pas.plugins.kimug import utils
 from plone import api
+from unittest.mock import patch
+from ZODB.POSException import ConflictError
 from zope.annotation.interfaces import IAnnotations
 
 import os
@@ -122,3 +124,20 @@ def test_set_allowed_groups(self, portal):
         utils._set_allowed_groups(oidc)
 
         assert oidc.allowed_groups == ("group.1 is - the first!",)
+
+
+class TestSetOidcSettings:
+    def test_conflict_error_is_handled(self, portal):
+        """ConflictError on commit must be caught and transaction aborted — no exception raised."""
+        with patch("pas.plugins.kimug.utils.transaction") as mock_txn:
+            mock_txn.commit.side_effect = ConflictError()
+            utils.set_oidc_settings(None)
+            mock_txn.abort.assert_called_once()
+
+    def test_settings_are_applied(self, portal):
+        """set_oidc_settings should apply environment values to the OIDC plugin."""
+        with patch.dict(os.environ, {"keycloak_client_id": "my-client"}):
+            with patch("pas.plugins.kimug.utils.transaction"):
+                utils.set_oidc_settings(None)
+        oidc = utils.get_plugin()
+        assert oidc.client_id == "my-client"